Drupal Commerce Flaw Exploited: Update to Version 3.3.13

Attackers are exploiting a Drupal Commerce flaw tracked as CVE-2026-118539, according to the Drupal security team. The bug sits in Commerce Core, rates as “highly critical,” and is fixed in Commerce Core 3.3.13 and 8.x-2.41. Drupal also asks store owners to audit their orders for inconsistencies after updating.

What happened in Drupal Commerce

Drupal is a PHP-based content management system used for company sites, universities, and public institutions. Commerce Core is the contributed module that turns a Drupal site into a store, adding a shopping cart, a checkout form, and APIs for decoupled front ends such as mobile apps or custom storefronts.

On October 28, 2026, Drupal published advisory SA-CONTRIB-2026-254 for the module. It says Commerce Core does not sufficiently protect certain routes and entity fields. That gap allows an access bypass, and Drupal warns the impact may be financial for the vendor running the store.

Drupal scored the issue 21 out of 25, which falls in the top band of its scale, labeled highly critical. The CVE record carries no CVSS score yet, so Drupal’s own rating is the main severity measure available. The scoring string in the advisory, AC:None/A:None/CI:Some/II:Some/E:Exploit/TD:All, means the attack is easy to carry out, needs no special privileges, affects the confidentiality and integrity of some data, has a working exploit in the wild, and applies to every installation of the module. Dan Puccetti, Marcus Johansson, and Robert Snyder reported the bug, and the module maintainers fixed it together with the Drupal security team.

ITdaily classifies it as a missing authorization flaw (CWE-862) and reports that no account is needed and every configuration of the module is vulnerable. SecurityWeek likewise says unauthenticated attackers can exploit it regardless of how the module is configured.

Drupal has not said which routes and fields are involved. ITdaily reports that attackers can view some non-public data and modify some data. In a store, that data can include orders, prices, or coupons, which explains why Drupal singles out order audits.

Exploitation status according to Drupal

The advisory is direct about exploitation. Its solution section reads: “Sites should audit their orders for inconsistencies as this vulnerability is being actively exploited.”

Drupal has not described how the bug is being exploited, who is behind the activity, how many sites were targeted, or whether attacks began before fixes were available. SecurityWeek noted those gaps in its October 30 report, and The Hacker News said the same day that no details about the scale of the campaign had been shared.

The potential exposure is large. According to SecurityWeek, Drupal’s usage statistics show Commerce Core on more than 42,000 sites. ITdaily breaks down the figure as of October 18, 2026: 42,002 sites, of which 13,028 run the 2.x branch and 17,019 run 3.x. Those two branches are the ones covered by the advisory, which puts roughly 30,000 sites in scope. The remaining 11,955 sites run the 1.x branch for Drupal 7.

Affected and fixed versions

According to SA-CONTRIB-2026-254:

• 3.x branch: versions from 3.0.0 up to, but not including, 3.3.13 are affected. Fixed release: Commerce Core 3.3.13.
• 2.x branch (named 8.x-2.x): all versions before 2.41 are affected. Fixed release: Commerce Core 8.x-2.41.
• 1.x branch for Drupal 7 is outside the scope of this advisory. ITdaily notes that Drupal 7 has received no security updates since January 5, 2025.

Both fixed releases have been available since October 28, 2026. ITdaily reports that they also address five lower-severity Commerce Core vulnerabilities.

Commerce Core was not the only module updated this week. SecurityWeek reports that Drupal released 38 other advisories on October 28 covering 21 contributed projects, nearly a dozen of them rated critical. Some of those bugs, SecurityWeek says, could lead to remote code execution, account takeover, or Stripe orders marked as paid without payment. Stores running additional payment modules should review every installed module, including those outside Commerce Core.

What this means for online stores

For stores built on Drupal, this flaw touches the most sensitive part of the business: orders and money. Altered order totals, coupons used in odd ways, or order statuses that shift can go unnoticed if a team only watches daily sales reports. These are the steps to take today.

1. Check your Commerce Core version. Open Reports, then Available updates, in the Drupal admin area, or run composer show drupal/commerce on the server. Compare the result with the version list above.
2. Install the fixed release. Sites on 3.x move to 3.3.13, and sites on 2.x move to 8.x-2.41. On Composer-based sites, run composer update drupal/commerce --with-dependencies, then apply database updates with drush updatedb and clear the cache. Back up the database first.
3. Audit orders. Follow Drupal’s advice and compare order totals against product prices and the payments actually received. Look for coupons redeemed repeatedly or by unknown accounts, and match order statuses against your payment gateway records.
4. Review other modules. Check the Drupal update list and apply security updates for payment, shipping, and other contributed modules named in the October 28 advisories.

If the audit turns up suspicious orders, preserve the evidence before correcting anything. Record order numbers, timestamps, accounts, and IP addresses from web server logs. That record helps establish when an attacker got in and whether customer data was exposed. If personal data was affected, review the notification duties under Indonesia’s Undang-Undang Nomor 27 Tahun 2022 tentang Pelindungan Data Pribadi (Personal Data Protection Law).

Sites still on Drupal 7 with Commerce 1.x are in a different position. This advisory does not apply to them, but the platform no longer receives official security updates either. Owners of those stores need a migration plan, whether to a current Drupal release or to another supported platform. Teams that run retail management systems alongside an online store can add module version tracking to a monthly checklist, next to backups and access log reviews.

This is not the first flaw in a PHP-based store platform this month. Magento operators faced a similar situation, covered in our piece on the PolyShell Magento flaw and store safety steps. The response follows the same pattern: update, look for traces, then tighten the routine update process.

Frequently asked questions

My Drupal site does not sell anything. Is it affected?

No, as long as the Commerce Core module is not installed. CVE-2026-118539 only concerns that module. Drupal did publish many other advisories the same week, so check the update list for the modules you do use.

My store already runs 3.3.13. Do I still need to review older orders?

Yes. The update blocks new attacks, but it does not correct orders or data that were changed earlier. Drupal has not said when the attacks began, so the review should cover at least the past few weeks of orders.

Is this flaw in the CISA KEV catalog?

Not yet. CVE-2026-118539 does not appear in the October 30, 2026 version of the CISA KEV catalog. The exploitation status comes directly from Drupal’s advisory, and a vendor confirmation is reason enough to update now.

Conclusion

The Commerce Core flaw targets the part of a store tied directly to revenue, and Drupal has confirmed that attacks are under way. Install 3.3.13 or 8.x-2.41, audit the past few weeks of orders, and review the other modules updated this week. If your team needs support with an online store audit or incident response, Merakit’s cybersecurity services can help.

Sources

• Drupal: Commerce Core - Highly critical - Access bypass - SA-CONTRIB-2026-254 (October 28, 2026)
• SecurityWeek: Drupal Commerce Core Vulnerability Exploited Against Online Stores (October 30, 2026)
• The Hacker News: Hackers Actively Exploit Highly Critical Drupal Commerce Core Authorization Bypass Flaw (October 30, 2026)
• ITdaily: 30,000 Drupal web shops potentially vulnerable to actively exploited access flaw (October 30, 2026)
• CISA: Known Exploited Vulnerabilities Catalog